Why Vulnerability Counts Should Give Way to Risk-Based Cyber Resilience
Summary
The opinion argues that faster vulnerability discovery, including through AI, should not be confused with greater risk. It urges security teams to prioritize remediation by business impact and focus on resilience and outcomes.
Key points
- The author argues that vulnerability discovery is not the same as exploitation or impact; vulnerabilities pose risk when acted upon by a threat.
- The article says AI is accelerating vulnerability discovery, but argues that remediation should be prioritized according to business impact rather than raw vulnerability counts.
- It cites CISA figures of more than 67,000 CVEs published by mid-September 2026 and an expectation of 96,000 new vulnerabilities by year-end.
- The author urges security teams to communicate risk and outcomes to executives and boards, including the business impact of exposures.
- The article says cyber resilience requires alignment between security teams and business units, incorporating AI into security strategies, and preparing stakeholders for IT outages.
- It cites Omdia research saying 87% of organizations are seeking new tooling built for the AI era.
Article Details
- Topic
- Cybersecurity vulnerability prioritization, business-impact-based remediation, and organizational resilience amid AI-accelerated vulnerability discovery